I don't think there is a statute of limitations on sending a bill to a patient. When a patient receives services, they know they are responsible for payment. It is always prudent to send them a bill as soon as possible, and you will probably have an upset patient after so long, however, I think it depends on WHY the patient is receiving a bill after one year. If you have been fighting the insurance company, and just now received the correct payment, you can justify the late billing. If it is just an oversight on the part of the office, it will be harder to justify, however, the patient is still responsible, and can be billed.
As far as requesting the SSN, there are some insurance companies who require a SSN for billing: Military, Medicare, etc. If the SSN is required to bill, you can explain this to the patient. If they refuse to give it to you, send them a bill for the full charges as they must provide valid information at the time of service if they want their insurance billed.
If you are simply 'acquiring' information because there is a space in your computer system for a SSN, then it may not be needed, nor required to bill, and you can do without it.
Many times a collection agency will require the SSN to pursue the patient for collections, and it is the office policy to obtain this information at the first visit. This is always the best idea. If a patient refuses up front, then have an office policy that they must pay cash for all visits until provided, and clearly explain this to the patient at the time of the first visit.